[Pkg-javascript-devel] Bug#1145882: node-ajv: CVE-2026-75899 CVE-2026-75931 CVE-2026-75975 CVE-2026-76172

[Salvatore Bonaccorso]

Source: node-ajv
Version: 8.20.0~ds+~cs7.1.3-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for node-ajv.

Unfortunately there was another "batch". They are related to the
embedded and provided fast-uri, could you please check them
individually?

CVE-2026-75899[0]:
| fast-uri is a URI parser for Node.js. It decodes percent escapes in
| a hostname during parsing and then decodes the parsed hostname a
| second time during authority recomposition, so a single call to
| normalize or resolve can turn nested percent-encoded input into a
| different network destination such as a loopback hostname or
| address. For example, a doubly encoded host that spells out a
| loopback name decodes to that live host in one operation, which
| contradicts RFC 3986 section 2.4 that an implementation must not
| decode the same string more than once. An application that
| normalizes or resolves an untrusted HTTP-family URI before outbound
| routing, redirect validation, or a host-policy check can receive a
| destination different from the one the original encoded host
| represented, giving a server-side request forgery and host-policy
| bypass primitive. This is an incomplete-fix variant of
| CVE-2026-6322. The affected versions are 2.4.1 up to but not
| including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up
| to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and
| 4.1.3, which normalize percent escapes once and preserve encoded
| percent signs. Users should upgrade to a patched version.


CVE-2026-75931[1]:
| fast-uri is a URI parser for Node.js. It canonicalizes a host to its
| ASCII form only when the input carries an explicit scheme, so a
| scheme-relative reference such as a host preceded by two slashes is
| returned with its host verbatim and no error set. As a result fast-
| uri's own entry points disagree with each other: parse, resolve,
| normalize, and equal can yield different hosts for the same input
| depending only on whether a scheme is written out, and equal can
| return opposite verdicts for the same pair of hosts. An application
| that extracts a host with fast-uri to check it against a policy list
| and then resolves the same reference can make its decision on one
| host while the destination is another, enabling host confusion and
| policy bypass. The affected versions are 2.4.2 up to but not
| including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up
| to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and
| 4.1.3, which canonicalize the host consistently across the resolve
| path. Users should upgrade to a patched version.


CVE-2026-75975[2]:
| fast-uri is a URI parser for Node.js. Its custom parser for
| bracketed IPv6 literals does not validate the complete IPv6 grammar,
| so invalid trailing text in an authority can be silently discarded
| and a malformed attacker-controlled host is turned into a different
| valid IPv6 destination. For example, a bracketed literal with
| invalid trailing characters is normalized to the unspecified
| address, which a Node HTTP client then connects to a local service
| over loopback, and other malformed literals collapse to private-
| range addresses. No error is set on the parsed result, so an
| application checking the error field cannot detect the rewrite. An
| application that normalizes untrusted URLs before outbound requests,
| redirects, proxy routing, or address-policy enforcement can be
| redirected to a local or private IPv6 target, giving a server-side
| request forgery and address-policy bypass primitive. The affected
| versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but
| not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The
| issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed
| IP literals against the full grammar and mark malformed literals as
| authority errors. Users should upgrade to a patched version.


CVE-2026-76172[3]:
| fast-uri is a URI parser for Node.js. During parsing it runs a
| legacy decoding pass over the scheme component and never re-escapes
| the result, and serialization writes the scheme back out verbatim,
| unlike the host component which is re-escaped. As a result an input
| whose scheme carries percent-encoded slashes parses as a scheme with
| no authority, so the parsed host and error are both undefined, yet
| resolving or normalizing that same input emits a network-path
| reference whose authority is attacker-chosen and re-parses to that
| host. An application that allowlists on the parsed host, or treats a
| reference with no authority as safe to resolve against its base,
| gets the opposite of what it checked, giving an off-site redirect,
| server-side request forgery, or address-policy bypass. The legacy
| decoder also expands non-standard escape forms, widening the issue
| past upstream filters, and control characters in the scheme can
| reach the output as raw carriage return and line feed. The affected
| versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but
| not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The
| issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme
| that is not valid after decoding. Users should upgrade to a patched
| version.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-75899
    https://www.cve.org/CVERecord?id=CVE-2026-75899
[1] https://security-tracker.debian.org/tracker/CVE-2026-75931
    https://www.cve.org/CVERecord?id=CVE-2026-75931
[2] https://security-tracker.debian.org/tracker/CVE-2026-75975
    https://www.cve.org/CVERecord?id=CVE-2026-75975
[3] https://security-tracker.debian.org/tracker/CVE-2026-76172
    https://www.cve.org/CVERecord?id=CVE-2026-76172

Regards,
Salvatore